If it’s trivial for you to do so, could you try downgrading the guest to
chef-client 11.4.0 and trying your run in that environment?

I developed this whole big fancy RunDeck cookbook with self-provisioning
data bags (encrypted + plaintext) against Chef 11.4.0 nodes and it broke
with almost the same error once I started testing it in Chef 11.4.4 /
10.26.0…

(There were other changes I had to make in order to get it to play nice in
that org, but if you’re doing something similar, perhaps it’s not my
overly-ambitious code that is buggy? )